CVE-2024-56672 (GCVE-0-2024-56672)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:06 – Updated: 2026-08-05 11:46
VLAI
Title
blk-cgroup: Fix UAF in blkcg_unpin_online()
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online(). Fix it by reading the parent pointer before destroying the blkcg's blkg's.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-10 17:12 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4308a434e5e08c78676aa66bc626ef78cbef0883 , < 83f5a87ee8caa76a917f59912a74d6811f773c67 (git)
Affected: 4308a434e5e08c78676aa66bc626ef78cbef0883 , < 8a07350fe070017a887433f4d6909433955be5f1 (git)
Affected: 4308a434e5e08c78676aa66bc626ef78cbef0883 , < 64afc6fe24c9896c0153e5a199bcea241ecb0d5c (git)
Affected: 4308a434e5e08c78676aa66bc626ef78cbef0883 , < 5baa28569c924d9a90d036c2aaab79f791fedaf8 (git)
Affected: 4308a434e5e08c78676aa66bc626ef78cbef0883 , < 29d1e06560f0f6179062ac638b4064deb637d1ad (git)
Affected: 4308a434e5e08c78676aa66bc626ef78cbef0883 , < 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.234 , ≤ 5.10.* (semver)
Unaffected: 5.15.177 , ≤ 5.15.* (semver)
Unaffected: 6.1.121 , ≤ 6.1.* (semver)
Unaffected: 6.6.67 , ≤ 6.6.* (semver)
Unaffected: 6.12.6 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T17:12:31.915249Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T17:21:07.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:52:20.150Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:01:24.932Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83f5a87ee8caa76a917f59912a74d6811f773c67",
              "status": "affected",
              "version": "4308a434e5e08c78676aa66bc626ef78cbef0883",
              "versionType": "git"
            },
            {
              "lessThan": "8a07350fe070017a887433f4d6909433955be5f1",
              "status": "affected",
              "version": "4308a434e5e08c78676aa66bc626ef78cbef0883",
              "versionType": "git"
            },
            {
              "lessThan": "64afc6fe24c9896c0153e5a199bcea241ecb0d5c",
              "status": "affected",
              "version": "4308a434e5e08c78676aa66bc626ef78cbef0883",
              "versionType": "git"
            },
            {
              "lessThan": "5baa28569c924d9a90d036c2aaab79f791fedaf8",
              "status": "affected",
              "version": "4308a434e5e08c78676aa66bc626ef78cbef0883",
              "versionType": "git"
            },
            {
              "lessThan": "29d1e06560f0f6179062ac638b4064deb637d1ad",
              "status": "affected",
              "version": "4308a434e5e08c78676aa66bc626ef78cbef0883",
              "versionType": "git"
            },
            {
              "lessThan": "86e6ca55b83c575ab0f2e105cf08f98e58d3d7af",
              "status": "affected",
              "version": "4308a434e5e08c78676aa66bc626ef78cbef0883",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.177",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.121",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.67",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix UAF in blkcg_unpin_online()\n\nblkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To\nwalk up, it uses blkcg_parent(blkcg) but it was calling that after\nblkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the\nfollowing UAF:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270\n  Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117\n\n  CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n  Workqueue: cgwb_release cgwb_release_workfn\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x27/0x80\n   print_report+0x151/0x710\n   kasan_report+0xc0/0x100\n   blkcg_unpin_online+0x15a/0x270\n   cgwb_release_workfn+0x194/0x480\n   process_scheduled_works+0x71b/0xe20\n   worker_thread+0x82a/0xbd0\n   kthread+0x242/0x2c0\n   ret_from_fork+0x33/0x70\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n  ...\n  Freed by task 1944:\n   kasan_save_track+0x2b/0x70\n   kasan_save_free_info+0x3c/0x50\n   __kasan_slab_free+0x33/0x50\n   kfree+0x10c/0x330\n   css_free_rwork_fn+0xe6/0xb30\n   process_scheduled_works+0x71b/0xe20\n   worker_thread+0x82a/0xbd0\n   kthread+0x242/0x2c0\n   ret_from_fork+0x33/0x70\n   ret_from_fork_asm+0x1a/0x30\n\nNote that the UAF is not easy to trigger as the free path is indirected\nbehind a couple RCU grace periods and a work item execution. I could only\ntrigger it with artifical msleep() injected in blkcg_unpin_online().\n\nFix it by reading the parent pointer before destroying the blkcg\u0027s blkg\u0027s."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local operations \u2014 creating/enabling an `io` cgroup, dirtying pages to instantiate a cgroup writeback structure, and rmdir\u0027ing the cgroup. No network-facing code path reaches `blkcg_unpin_online()`.\nAC:L - The attacker drives both sides: the cgwb release that reaches the stale read and the css free chain are both initiated by its own cgroup teardown, and the window is widened at will via `blkcg_destroy_blkgs()`\u0027s `cond_resched()` loop (blkg count, CPU load) while the create/write/rmdir cycle can be repeated indefinitely until the race lands.\nPR:L - An unprivileged user needs only write access to a delegated cgroup v2 subtree with the io controller enabled \u2014 standard under systemd user delegation, container runtimes, and unprivileged podman \u2014 plus ordinary buffered writes; no capability check guards the path.\nUI:N - The attacker performs every step itself \u2014 cgroup creation, file writes, and cgroup removal \u2014 with no victim action required.\nS:U - The corruption occurs in kernel slab memory and impacts the same kernel security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `struct blkcg` is allocated from a general kmalloc cache, so the freed object can be sprayed with attacker-controlled data; the stale `css.parent` read produces a controlled pointer that is subsequently dereferenced, giving a path to disclose arbitrary kernel memory.\nI:H - The UAF-derived pointer is fed straight into `refcount_dec_and_test(\u0026blkcg-\u003eonline_pin)` \u2014 an arbitrary decrement \u2014 and into `blkcg_destroy_blkgs()`, which performs hlist unlink writes on the bogus object, yielding write primitives suitable for control-flow hijack and privilege escalation.\nA:H - Even unweaponized, the slab-use-after-free reliably corrupts memory and oopses/panics the kernel, as demonstrated by the reported KASAN splat in a cgwb_release kworker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:00.581Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a07350fe070017a887433f4d6909433955be5f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7af"
        }
      ],
      "title": "blk-cgroup: Fix UAF in blkcg_unpin_online()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56672",
    "datePublished": "2024-12-27T15:06:33.358Z",
    "dateReserved": "2024-12-27T15:00:39.845Z",
    "dateUpdated": "2026-08-05T11:46:00.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56672",
      "date": "2026-08-27",
      "epss": "0.00271",
      "percentile": "0.1905"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56672\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:27.107\",\"lastModified\":\"2026-06-17T08:12:42.693\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-cgroup: Fix UAF in blkcg_unpin_online()\\n\\nblkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To\\nwalk up, it uses blkcg_parent(blkcg) but it was calling that after\\nblkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the\\nfollowing UAF:\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270\\n  Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117\\n\\n  CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\\n  Workqueue: cgwb_release cgwb_release_workfn\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x27/0x80\\n   print_report+0x151/0x710\\n   kasan_report+0xc0/0x100\\n   blkcg_unpin_online+0x15a/0x270\\n   cgwb_release_workfn+0x194/0x480\\n   process_scheduled_works+0x71b/0xe20\\n   worker_thread+0x82a/0xbd0\\n   kthread+0x242/0x2c0\\n   ret_from_fork+0x33/0x70\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n  ...\\n  Freed by task 1944:\\n   kasan_save_track+0x2b/0x70\\n   kasan_save_free_info+0x3c/0x50\\n   __kasan_slab_free+0x33/0x50\\n   kfree+0x10c/0x330\\n   css_free_rwork_fn+0xe6/0xb30\\n   process_scheduled_works+0x71b/0xe20\\n   worker_thread+0x82a/0xbd0\\n   kthread+0x242/0x2c0\\n   ret_from_fork+0x33/0x70\\n   ret_from_fork_asm+0x1a/0x30\\n\\nNote that the UAF is not easy to trigger as the free path is indirected\\nbehind a couple RCU grace periods and a work item execution. I could only\\ntrigger it with artifical msleep() injected in blkcg_unpin_online().\\n\\nFix it by reading the parent pointer before destroying the blkcg\u0027s blkg\u0027s.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blk-cgroup: corrige UAF en blkcg_unpin_online() blkcg_unpin_online() sube por la jerarqu\u00eda blkcg y coloca el pin en l\u00ednea. Para subir, usa blkcg_parent(blkcg) pero lo estaba llamando despu\u00e9s de blkcg_destroy_blkgs(blkcg) que podr\u00eda liberar el blkcg, lo que lleva al siguiente UAF: ====================================================================== ERROR: KASAN: slab-use-after-free en blkcg_unpin_online+0x15a/0x270 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff8881057678c0 por la tarea kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 No contaminado 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS desconocido 02/02/2022 Cola de trabajo: cgwb_release cgwb_release_workfn Seguimiento de llamadas:  dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30  ... Liberado por la tarea 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 Tenga en cuenta que el UAF no es f\u00e1cil de activar ya que la ruta libre es Se produjo un error indirecto detr\u00e1s de un par de per\u00edodos de gracia de RCU y una ejecuci\u00f3n de elemento de trabajo. Solo pude activarlo con msleep() artificial inyectado en blkcg_unpin_online(). Solucione el problema leyendo el puntero principal antes de destruir los blkg de blkcg.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/blk-cgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4308a434e5e08c78676aa66bc626ef78cbef0883\",\"lessThan\":\"83f5a87ee8caa76a917f59912a74d6811f773c67\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4308a434e5e08c78676aa66bc626ef78cbef0883\",\"lessThan\":\"8a07350fe070017a887433f4d6909433955be5f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4308a434e5e08c78676aa66bc626ef78cbef0883\",\"lessThan\":\"64afc6fe24c9896c0153e5a199bcea241ecb0d5c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4308a434e5e08c78676aa66bc626ef78cbef0883\",\"lessThan\":\"5baa28569c924d9a90d036c2aaab79f791fedaf8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4308a434e5e08c78676aa66bc626ef78cbef0883\",\"lessThan\":\"29d1e06560f0f6179062ac638b4064deb637d1ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4308a434e5e08c78676aa66bc626ef78cbef0883\",\"lessThan\":\"86e6ca55b83c575ab0f2e105cf08f98e58d3d7af\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/blk-cgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.234\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.177\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.121\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.67\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.6\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-10T17:12:31.915249Z\",\"id\":\"CVE-2024-56672\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7\",\"versionEndExcluding\":\"6.1.121\",\"matchCriteriaId\":\"DA13D8C8-4561-4F7A-8047-DAD1CB2DABD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.67\",\"matchCriteriaId\":\"BF4F2CD1-2CA6-4D6B-9B0C-57C3C4D6544A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a07350fe070017a887433f4d6909433955be5f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-23T19:31:28+00:00",
      "cve": "CVE-2024-56672",
      "id": "CVE-2024-56672",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "188",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: blk-cgroup: Fix UAF in blkcg_unpin_online()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56672.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:52:20.150Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T12:01:24.932Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56672\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-10T17:12:31.915249Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-10T17:12:33.315Z\"}}], \"cna\": {\"title\": \"blk-cgroup: Fix UAF in blkcg_unpin_online()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only through local operations \\u2014 creating/enabling an `io` cgroup, dirtying pages to instantiate a cgroup writeback structure, and rmdir\u0027ing the cgroup. No network-facing code path reaches `blkcg_unpin_online()`.\\nAC:L - The attacker drives both sides: the cgwb release that reaches the stale read and the css free chain are both initiated by its own cgroup teardown, and the window is widened at will via `blkcg_destroy_blkgs()`\u0027s `cond_resched()` loop (blkg count, CPU load) while the create/write/rmdir cycle can be repeated indefinitely until the race lands.\\nPR:L - An unprivileged user needs only write access to a delegated cgroup v2 subtree with the io controller enabled \\u2014 standard under systemd user delegation, container runtimes, and unprivileged podman \\u2014 plus ordinary buffered writes; no capability check guards the path.\\nUI:N - The attacker performs every step itself \\u2014 cgroup creation, file writes, and cgroup removal \\u2014 with no victim action required.\\nS:U - The corruption occurs in kernel slab memory and impacts the same kernel security authority; no VM, IOMMU, or hypervisor boundary is crossed.\\nC:H - `struct blkcg` is allocated from a general kmalloc cache, so the freed object can be sprayed with attacker-controlled data; the stale `css.parent` read produces a controlled pointer that is subsequently dereferenced, giving a path to disclose arbitrary kernel memory.\\nI:H - The UAF-derived pointer is fed straight into `refcount_dec_and_test(\u0026blkcg-\u003eonline_pin)` \\u2014 an arbitrary decrement \\u2014 and into `blkcg_destroy_blkgs()`, which performs hlist unlink writes on the bogus object, yielding write primitives suitable for control-flow hijack and privilege escalation.\\nA:H - Even unweaponized, the slab-use-after-free reliably corrupts memory and oopses/panics the kernel, as demonstrated by the reported KASAN splat in a cgwb_release kworker.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\", \"lessThan\": \"83f5a87ee8caa76a917f59912a74d6811f773c67\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\", \"lessThan\": \"8a07350fe070017a887433f4d6909433955be5f1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\", \"lessThan\": \"64afc6fe24c9896c0153e5a199bcea241ecb0d5c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\", \"lessThan\": \"5baa28569c924d9a90d036c2aaab79f791fedaf8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\", \"lessThan\": \"29d1e06560f0f6179062ac638b4064deb637d1ad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\", \"lessThan\": \"86e6ca55b83c575ab0f2e105cf08f98e58d3d7af\", \"versionType\": \"git\"}], \"programFiles\": [\"block/blk-cgroup.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.234\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.177\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.121\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.67\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"block/blk-cgroup.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67\"}, {\"url\": \"https://git.kernel.org/stable/c/8a07350fe070017a887433f4d6909433955be5f1\"}, {\"url\": \"https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5c\"}, {\"url\": \"https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8\"}, {\"url\": \"https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1ad\"}, {\"url\": \"https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7af\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-cgroup: Fix UAF in blkcg_unpin_online()\\n\\nblkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To\\nwalk up, it uses blkcg_parent(blkcg) but it was calling that after\\nblkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the\\nfollowing UAF:\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270\\n  Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117\\n\\n  CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\\n  Workqueue: cgwb_release cgwb_release_workfn\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x27/0x80\\n   print_report+0x151/0x710\\n   kasan_report+0xc0/0x100\\n   blkcg_unpin_online+0x15a/0x270\\n   cgwb_release_workfn+0x194/0x480\\n   process_scheduled_works+0x71b/0xe20\\n   worker_thread+0x82a/0xbd0\\n   kthread+0x242/0x2c0\\n   ret_from_fork+0x33/0x70\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n  ...\\n  Freed by task 1944:\\n   kasan_save_track+0x2b/0x70\\n   kasan_save_free_info+0x3c/0x50\\n   __kasan_slab_free+0x33/0x50\\n   kfree+0x10c/0x330\\n   css_free_rwork_fn+0xe6/0xb30\\n   process_scheduled_works+0x71b/0xe20\\n   worker_thread+0x82a/0xbd0\\n   kthread+0x242/0x2c0\\n   ret_from_fork+0x33/0x70\\n   ret_from_fork_asm+0x1a/0x30\\n\\nNote that the UAF is not easy to trigger as the free path is indirected\\nbehind a couple RCU grace periods and a work item execution. I could only\\ntrigger it with artifical msleep() injected in blkcg_unpin_online().\\n\\nFix it by reading the parent pointer before destroying the blkcg\u0027s blkg\u0027s.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.234\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.177\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.121\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.67\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.6\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"5.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:00.581Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56672\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:00.581Z\", \"dateReserved\": \"2024-12-27T15:00:39.845Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:06:33.358Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.